#include <unistd.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <errno.h>
#include <limits.h>
#include <sys/time.h>
 
#include "data_type.h"
#include "cube.h"
#include "cube_define.h"
#include "cube_record.h"
#include "user_define.h"
#include "record_define.h"
#include "mac_label.h"
// add para lib_include
int record_acl_init(void * sub_proc, void * para)
{
	int ret;
	// add yorself's module init func here
	return 0;
}

int record_acl_start(void * sub_proc, void * para)
{
	int ret;
	void * recv_msg;
	int type;
	int subtype;
	// add yorself's module exec func here
	while(1)
	{
		usleep(time_val.tv_usec);
		ret=ex_module_recvmsg(sub_proc,&recv_msg);
		if(ret<0)
			continue;
		if(recv_msg==NULL)
			continue;
		type=message_get_type(recv_msg);
		subtype=message_get_subtype(recv_msg);
		if(!memdb_find_recordtype(type,subtype))
		{
			printf("message format (%d %d) is not registered!\n",
			message_get_type(recv_msg),message_get_subtype(recv_msg));
			continue;
		}
		else if((type==TYPE(RECORD_DEFINE))&&(subtype==SUBTYPE(RECORD_DEFINE,RECORD)))
		{
			ret=proc_access_read(sub_proc,recv_msg);
		}
	}
	return 0;
}

int read_acl(RECORD(MAC_LABEL,SUBJECT) * sub_label,RECORD(MAC_LABEL,OBJECT) * obj_label)
{
//  add blp module access control code here
//  return 1 means access is permitted
	if ((sub_label->label.sec_class | obj_label->label.sec_class) == sub_label->label.sec_class)
    	if (sub_label->label.sec_label >= obj_label->label.sec_label)
      		return 1;

	return 0;	
}
int get_level(char* position)
{
	if(strcmp(position,"ER") == 0){
		return 1;
	}else if(strcmp(position,"PM") == 0){
		return 2;
	}else if(strcmp(position,"DM") == 0){
		return 2;
	}else if(strcmp(position,"CTO") == 0){
		return 4;
	}else if(strcmp(position,"CFO") == 0){
		return 4;
	}else if(strcmp(position,"CAO") == 0){
		return 4;
	}else if(strcmp(position,"CMO") == 0){
		return 4;
	}else if(strcmp(position,"CEO") == 0){
		return 5;
	}
}
enum flag_sec_class convert(char* department)
{
	switch(department[0]){
		case 'R':
			return R;
		case 'F':
			return F;
		case 'M':
			return M;
		case 'A':
			return A;
		default:
			return 0;
	}
}
RECORD(MAC_LABEL,OBJECT) * compute_objlabel(RECORD(RECORD_DEFINE,RECORD) * record_data,RECORD(MAC_LABEL,RECORD) * record_label)
{
	RECORD(MAC_LABEL,OBJECT) * obj_label = Talloc0(sizeof(struct mac_label_object));
	obj_label->user_name = dup_str(record_data->name,DIGEST_SIZE);

	Strncpy(obj_label->user_id,record_data->ID,sizeof(record_data->ID));
	Strncpy(obj_label->record_name,record_label->name,sizeof(record_label->name));
	//obj_label->record_name = dup_str(record_label->name,)

	if(record_label->isselfdefine == 1){
		obj_label->label.sec_class = record_label->class;
	}else{
		obj_label->label.sec_class = convert(record_data->department);
		
	}

	if(record_label->isleveladjust == 1){
		obj_label->label.sec_label = record_label->level_adjust + get_level((record_data->position));
	}else{
		obj_label->label.sec_label = record_label->level_fix;
	}

	return obj_label;
}
int except_rule(char * record_name,char * read_user,char * record_user)
{
	int ret;
	if(strcmp(record_name,"salary")==0)
	{
		if(strcmp(read_user,record_user)==0)
			return 1;
	}
	return 0;
}

int proc_access_read(void * sub_proc,void * recv_msg)
{
	int ret;
	RECORD(RECORD_DEFINE,RECORD) * record_data;
	RECORD(MAC_LABEL,SUBJECT) * user_label;
	RECORD(MAC_LABEL,OBJECT) * object_label;
	RECORD(MAC_LABEL,RECORD) * record_label;
	MSG_EXPAND * msg_expand;
	DB_RECORD * db_record;
	void * new_msg;
	ELEM_ATTR * elem_attr;
	int i;
	int elem_no;
	void * record_template;


	//获取待进行访控处理的数据 
	ret=message_get_record(recv_msg,&record_data,0);
	if(ret<0)
		return ret;

	//获取本次访问的主体标记
	ret=message_remove_expand(recv_msg,TYPE_PAIR(MAC_LABEL,SUBJECT),&msg_expand);
	if(ret<0)
		return ret;
	if(msg_expand==NULL)
	{
		print_cubeerr("can't find user attached!\n");	
		return -EINVAL;
	}
	user_label=msg_expand->expand;

	//获取客体标记，分二步，第一步,获取记录项的客体属性
	//  target: get record_label
		
	record_template = memdb_get_template(TYPE_PAIR(RECORD_DEFINE,RECORD));
	if(record_template == NULL)
		return -EINVAL;

	elem_no = struct_get_elem_no(record_template);

	for(i=0;i<elem_no;i++)
	{
		elem_attr = struct_get_elem(record_template,i);

		db_record=memdb_find_first(TYPE_PAIR(MAC_LABEL,RECORD),"name",elem_attr->name);
		if(db_record==NULL)
		{
			print_cubeerr("record_label: can't find %s!\n",elem_attr->name);
			continue;
		}
	
		record_label=db_record->record;
		
	
		//获取客体标记第二步,使用用户信息和客体属性来计算客体标记
		// printf(" record  label value: %d %d\n",record_label->isleveladjust,record_label->level_adjust);
	 
        	object_label = compute_objlabel(record_data,record_label);	
		//根据主体标记和客体标记执行访问控制
		// printf(" obj label value: %x %d\n",object_label->label.sec_class,object_label->label.sec_label);
		ret = read_acl(user_label,object_label);
	
		//根据访问控制结果对记录项进行处理
		if(ret == 0){
			if(!except_rule(elem_attr->name,user_label->user_name,
				record_data->name))
			{
				switch(elem_attr->type)	
				{	
					case CUBE_TYPE_STRING:
						{
							char file_string[DIGEST_SIZE];
							Memset(file_string,'*',elem_attr->size);
							ret=struct_write_elem_byno(i,record_data,file_string,record_template);

						}
					break;
					case CUBE_TYPE_ESTRING:
						{
							char file_string[DIGEST_SIZE];
							file_string[0]='\0';
							ret=struct_write_elem_byno(i,record_data,file_string,record_template);

						}
					break;
					case CUBE_TYPE_INT:
						{	
							int value=0;
							ret=struct_write_elem_byno(i,record_data,&value,record_template);
						
						}
						break;
					default:
						return -EINVAL;
				}
			}
		}
	}


	new_msg=message_create(TYPE_PAIR(RECORD_DEFINE,RECORD),recv_msg);
	if(new_msg==NULL)
		return -EINVAL;
	message_add_record(new_msg,record_data);
	ret=ex_module_sendmsg(sub_proc,new_msg);
	return ret;
}
